CVE-2026-55889

A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator (PRNG) to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the internal state of the generator, a malicious sandboxed application can predict future tokens. This flaw allows an attacker to intercept or redirect clipboard and drag-and-drop data intended for other applications, resulting in unauthorized data disclosure.

This flaw is rated with Moderate severity for Red Hat Enterprise Linux because exploitation is restricted to local environments, requiring an already-installed sandboxed application to repeatedly query the portal to guess authorization values rather than granting remote or elevated system privileges. Standard server installations without graphical desktop environments or containerized desktop software are unaffected in practice, as the portal services are not invoked. In workstation and desktop deployments running Flatpak or similar isolated applications, an attacker could potentially observe or redirect user-initiated clipboard transfers between desktop programs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.